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REMARKS/ARGUMENTS 



By this amendment, Claims 6, 13, and 21-40 are amended, and no claims are added or 
cancelled. Hence, Claims 1-40 are pending in the application. 

The amendment to Claims 6, 13, 26, and 33 as indicated herein does not add any new 
matter to this application. Furthermore, the amendment made to Claims 6, 13, 26, and 33 as 
indicated herein has been made to exclusively improve clarity of the claims and not for the 
purpose of overcoming alleged prior art. 

The amendment to Claims 21-40 to specifically recite a "computer-readable storage 
medium. . ." should also be entered in order to place the application in better condition for 
appeal because the original computer-readable medium claims cover a signal, which is non- 
statutory subject matter, whereas a "computer-readable storage medium" cannot include a 
signal because signals are incapable of storing instructions. 

I. SUMMARY OF THE REJECTIONS/OBJECTIONS 

Claims 1-5 and 21-25 stand rejected under 35 U.S.C. § 103(a) as allegedly being 
unpatentable over U.S. Patent Publication No. 2002/0143735 to Ayi et al. ("Ayi") in view of 
U.S. Patent No. 5,787,428 issued to Hart ("Hart"). This rejection is respectfully traversed. 

Claims 6-20 and 26-40 stand rejected under 35 U.S.C. § 103(a) as allegedly being 
unpatentable over U.S. Patent No. 5,859,966 issued to Hayman et al. ("Hayman") in view of 
Ayi. This rejection is respectfully traversed. 

II. THE REJECTIONS BASED ON THE CITED ART 

A. CLAIMS 1-5 AND 21-25 

Claims 1-5 and 21-25 stand rejected under 35 U.S.C. § 103(a) as allegedly being 
unpatentable over Ayi in view of Hart. It is the Final Office Action's position that the evidence 



OID 2001-090-01 



12 



Docket No. 50277-1774 



submitted is insufficient to establish a reduction to practice of the invention according to 
Claims 1-5 and 21-25 prior to the effective date of Ayi (page 2). The Final Office Action 
contends that the subject declaration (a) amounts to a general allegation and (b) lacks a 
statement of the facts demonstrating the correctness of the declaration, by the inventors, that the 
invention was reduced to practice prior to the effective date of Ayi (page 2). It is respectfully 
submitted that this is incorrect. 

The Final Office Action fails to address any of the arguments presented in the response 
mailed on August 14, 2007. Therefore, much of the same arguments are included herein. 

On page 3, the Final Office Action referred to a statement from representatives of the 

Applicants, which states: 

Obviously, test script files and test script log files do not show the actual 
code that performs recited steps. Therefore, for example, it is difficult to 
show the step of "determining which policies. . ." and the step of "determining 
whether to perform the operation." (emphasis added) 

In response to this statement, the Final Office Action contends that "without correlating the 

limitations of at least the independent claims to Applicant's Exhibits, the Applicant has failed 

to show possession of the claimed invention." Representatives of the Applicants respectfully 

request the Examiner to point out in the CFR and/or MPEP where it is required that limitations 

of the claims must be correlated to exhibits . In fact, 37 CFR § 1.131 provides the standard for 

the sufficiency of a showing of a reduction to practice: 

The showing of facts shall be such, in character and weight, as to establish 
reduction to practice prior to the effective date of the reference, or concep- 
tion of the invention prior to the effective date of the reference coupled with due 
diligence from prior to said date to a subsequent reduction to practice or to the 
filing of the application. Original exhibits of drawings or records, or photocopies 
thereof, must accompany and form part of the affidavit or declaration or their 
absence must be satisfactorily explained, (emphasis added) 
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As is clear, an Examiner is not required to find a correlation between all the limitations in a 
claim and exhibits in order to find the sufficiency of a declaration under 37 CFR § 1.131. 
Rather, the standard is that the "showing of facts shall be such, in character and weight, as to 
establish reduction to practice prior to the effective date of the reference." 

Also on page 3, the Final Office Action quotes MPEP § 715.02, which states: "If the 
affidavit contains facts showing a completion of the invention commensurate with the extent 
of the invention as claimed is shown in the reference or activity, the affidavit or declaration is 
sufficient" (emphasis in the Final Office Action). This section of the MPEP actually 
supports the Applicants' position. The present declaration satisfies the criteria specified in 
MPEP § 715.02, i.e., the declaration contains facts showing a completion of the invention 
commensurate with the extent of the invention as claimed. For example, the declaration states: 

3. We conceived and reduced to practice an implementation of claims 1 

- 5 and 21 - 25 before the effective filing date of Ayi. 

4. We participated on a team that developed the implementation of claims 1 

- 5 and 21 - 25 that is incorporated into an Oracle™ database server 
product. After the design phase of the development, successful tests 
were run to show that the implementation worked according to 
claims 1-5 and 21-25 . These tests, which were conducted using 
standard internal test processes and procedures, were completed before 
the effective filing date of Ayi and were carried out in this country. 

(emphasis added) 

Therefore, the declaration is sufficient . 

On page 4, the Final Office Action provides patent office policy for actual reductions to 
practice under 37 CFR § 1.131, which office policy apparently states: 

a. Testing is required unless operativeness of invention is readily apparent. 

b. Testing, if required, must be under actual working conditions or realistic 
simulation of working conditions. 

c. Test results must be repeatable. 
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In support of this policy, the Final Office Action cited MPEP § 2138.05. However, MPEP § 
2138.05 pertains to interference practice and 37 CFR 1.131 does not apply in interference 
proceedings (see MPEP 2138.01(m)). Neither the CFR nor the MPEP require testing in a Rule 
131 declaration. Nevertheless, the inventors stated, in the declaration that "successful tests 
were run to show that the implementation worked according to claims 1-5 and 21 - 25" (f 
4; emphasis added). Furthermore, software tests are clearly repeatable. If 1 4 of the declaration 
was considered by the Examiner, then it is appears from this appeal for testing of the invention 
that the Examiner might want to personally witness tests being run. However, there is no such 
requirement. Instead, MPEP § 715.07(1) requires examiners to " consider all of the evidence 
presented in its entirety, including the... declarations" (emphasis added). Thus, because the 
declaration is also evidence of a reduction to practice of the invention, the declaration must be 
considered. 

Finally, on page 4, the Final Office Action states that "the examiner cannot determine 
whether or not the reduced to practice invention is commensurate with the claims without the 
nexus between the claim and the Exhibit. As a result, the Examiner has no basis to 
approve the affidavit" (page 4; emphasis in the Final Office Action). It is respectfully 
submitted that the Examiner has ample basis to approve the declaration. 

First, the statements by the inventors in the subject declaration are not hollow 
assertions. Rather, they are specific statements of fact . (Again see MPEP § 715.07(1) which 
states that evidence includes the declaration.) As such, the statements are considered evidence, 
each of which cannot be ignored. 

Second, the courts have stated that " the PTO is required to accept Rule 131 Affidavits at 
face value , and without investigation " (see, e.g., Herman v. Williams Brooks Shoe Co., 39 
USPQ2d 1773, 1777 (S.D. N.Y. 1996); see also Chisum on Patents § 3.08[l][a] (2005); 
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emphasis added). Based on the specific evidence provided in the declaration, the inventors 
have satisfied their burden to prove that a working implementation of the invention according 
to Claims 1-5 and 21-25 existed prior to the effective filing date of Ayi. 

Third, MPEP § 715.07 states, "An accompanying exhibit need not support all 
claimed limitations, provided that any missing limitation is supported by the declaration 
itself." Indeed, exhibits are not even required by 37 CFR § 1.131 or the MPEP. Exhibits A-D 
are either test script files or test script log files that show results of running the corresponding 
test script. The exhibits do not provide the actual code. However, neither the CFR nor the 
MPEP require code to be submitted in an exhibit, nor do the CFR and MPEP require a 
declaration to state word-for-word each claim limitation. To require a declaration to state 
word-for-word each claim limitation would be mere form over substance since Applicants may 
simply recite each claim limitation and state that such claim limitation was implemented before 
a certain date. Nevertheless, the inventors have done effectively as much when referring (1) 
specifically to Claims 1-5 and 21-25 in \ 3, 4, and 9 of the declaration and (2) implicitly in the 
remaining statements. Therefore, it is odd that the Final Office Action would assert that "the 
examiner cannot determine whether or not the reduced to practice invention is commensurate 
with the claims." Contrary to this assertion in the Final Office Action, the Applicants have 
given "a clear explanation of the exhibits [in the declaration] pointing out exactly what facts are 
established and relied on by applicant." MPEP § 715.07. 

As stated above, the Patent Office is required to accept Rule 131 declarations at face 
value, without investigation. Based on the foregoing, it is respectfully submitted that the 
declaration and the accompanying exhibits are sufficient to prove a reduction to practice of the 
invention. Accordingly, reconsideration of the declaration is respectfully requested. 
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B. CLAIMS 6-20 AND 26-40 

Claims 6-20 and 26-40 stand rejected under 35 U.S.C. § 103(a) as allegedly being 
unpatentable over Hayman in view of Ayi. 

1. Claims 6 and 26 
Claims 6 and 26 recite: 

registering, with a database management system, one or more packages of 

routines, wherein each package of said one or more packages implements 
a security model that supports a model set of one or more policies of 
the database policy set and said each package includes an access 
mediation routine; 

associating a first policy, of a first model set in a first package of the one or 
more packages, with a first table within the database system; 

based on the association of the first policy with the first table, determining 
that the first policy applies to the first table; and 

in response to determining that the first policy applies to the first table, 
invoking the access mediation routine in the first package to 
determine, based on the first policy, whether to allow an operation 
on data in the first table, (emphasis added) 

Claims 6 and 26 require that: (1) a package is registered with a database management 
system; (2) the package implements a security model that supports a policy; (3) the package 
includes an access mediation routine; (4) the policy is associated with, and applies to, a table; 
and (5) the access mediation routine is invoked to determine, based on the policy, whether an 
operation on data in the table is allowed. 

Fundamentally, Claims 6 and 26 require that in response to determining that a policy 
of a package applies to a table, the access mediation routine of that same package is 
invoked to determine whether an operation is allowed on data of that table. This feature is 
not taught or suggested by Hayman or Ayi, either individually or in combination. The Final 
Office Action cites Hayman for disclosing all features of Claims 6 and 26 except for the recited 
first table (page 9). Ayi is only cited to show that labels are applied to tables (page 9). 
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On page 8, the Final Office Action alleges that the "applicant admits that registering one 

or more packages of routines are well known in the art" on page 17 of the Specification. This is 

plainly incorrect. The italicized sentence below is taken completely out of context. The 

applicable language from the Specification states: 

In step 212a first security model package is registered with the security manager 
132 of the database server 130. In some embodiments, the database security 
administrator designs and develops the security model package. In some 
embodiments the security model package is provided by the developer of the 
security manager 132, or is provided by a third party vendor, so that a database 
administrator does not have to develop her own package. For example, a 
security model package 110 that supports a compartmented security model is 
provided by the developer of the security manager, and the database security 
administrator registers the package 110 with the database server 130. Any 
manner known in the art for registering the package at the time the package is 
registered can be used. For example, the database security administrator 
types in a name of the file containing the package in a dialog box of a 
graphical user interface for the security manager 132 of the database server 
130 (page 17, paragraph 57) (emphasis added). 

Clearly, what is meant by "any manner known in the art for registering the package at the time 

the package is registered can be used" is that the manner in which a package is identified for 

being registered is not important (e.g., dialog box of a GUI or DOS command). However, 

nothing in the Specification implies or suggests that previous database systems actually register 

one or more packages of routines as claimed (i.e., wherein each package implements a security 

model and includes an access mediation routine). The Final Office Action and previous Office 

Actions have failed to address this argument . 

Also on page 8, the Final Office Action asserts that "Hayman teaches incorporate and 

installation security software which inherently includes registering one or more packages of 

routines." The portion of Hayman that refer to the incorporation and installation of security 

software describe a Session Monitor. The "Session Monitor has been designed to be extensible, 

in the sense that the owner of the security system can incorporate their own software to change 
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access mode of a user or administrator" (col. 8, line 66 - col. 9, line 2). Thus, the Final Office 
Action equates the Session Monitor with a package of routines. 

The Session Monitor, however, "controls the manner in which a user or administrator 
initially gains access to the system , and the manner in which a user or administrator changes 
from their current mode of access to a different mode (for example, from user to 
administrator)" (col. 8, lines 55-60; emphasis added), whereas Claim 6 requires that a policy of 
a package is associated with a table within the database system. There is no teaching or 
suggestion in Hayman that the Session Monitor, or any component thereof, is associated 
with a table within a database system. 

The Final Office Action also cites two paragraphs of Hayman that describe a Reference 
Monitor for teaching the first and third steps of Claim 6 (page 8). "The Reference Monitor is 
the entity that mediates all requests for access to an object by a subject, and thus controls 
whether, and to what extent, the subject is granted access to the object" (col. 9, lines 56-59). 
However, the reference does not disclose that a Reference Monitor may be registered so that it 
can be customized and implemented by the user. Indeed, the Reference Monitor was described 
in a version of Data General's security system as being "tightly integrated with Data General's 
operating system" (col. 1, lines 26-28). This indicates that customization is not readily possible 
and that the Reference Monitor is actually an embedded native software component of the 
security system, not a separate package that can be registered . Again, this is all in 
contradiction to the elements of Claims 6 and 26. 

Col. 9, line 61 to col. 10, line 4 of Hayman further states: 

The various subject-to-object access policies described above can be 
implemented by storing various policy data in an Information Security Policy 
Table database, which is maintained as part of the Reference Monitor. 

The Information Security Policy Table database contains policy modules which 
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the Reference Monitor must invoke to check access. This table can be 
configured when the system software is first installed, to meet the specific 
security policy of the specific computer system. Further, the table can be altered 
when the security policy of the enterprise changes. 

Perhaps the Final Office Action is equating (a) the policy modules in the Information Security 

Policy Table database of Hayman with the recited access mediation routine of Claims 6 and 26 

and (b) the policy data stored in the Information Security Policy Table database of Hayman 

with the recited first policy of Claims 6 and 26. However, Hayman fails to teach or suggest that 

a policy module and policy data (1) originate from the same package (2) that is registered with 

a database management system. 

The Final Office Action also alleges that Hayman col. 5, lines 18-60 teaches 
"associating a first policy of a first model set in a first package with" an object. To be clear, 
instead of an object, Claim 6 states that the first policy is associated with "a first table within 
the database system". The Office Action equates the "labels" described in the above cited 
portion of Hayman with the "first policy" of Claim 6. However, the "first policy" of Claim 6 is 
a policy of a package that is registered with a database management system. No where 
does Hayman teach or suggest in the above cited portion that a "label" is registered with a 
database management system. 

Thus, because Hayman, alone or in combination with Ayi, does not teach, suggest, or 
render obvious Claims 6 and 26, it is respectfully submitted that Claims 6 and 26 are patentable 
over the combination of Hayman and Ayi. Reconsideration and withdrawal of the rejection of 
Claims 6 and 26 under 35 U.S.C. § 103(a) is therefore respectfully requested. 

2. Dependent Claims 
The pending claims not discussed so far (Claims 7-20 and 25-40) are dependent claims 
that depend on an independent claim that is discussed above. Because each of the dependent 
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claims includes the limitations of claims upon which they depend, the dependent claims are 
patentable for at least those reasons the claims upon which the dependent claims depend are 
patentable. Removal of the rejections with respect to the dependent claims and allowance of 
the dependent claims is respectfully requested. In addition, the dependent claims introduce 
additional limitations that independently render them patentable. Due to the fundamental 
difference already identified, a separate discussion of those limitations is not included at this 
time. 

III. CONCLUSION 

For the reasons set forth above, it is respectfully submitted that all of the pending claims 
are now in condition for allowance. Therefore, the issuance of a formal Notice of Allowance is 
believed next in order, and that action is most earnestly solicited. 

The Examiner is respectfully requested to contact the undersigned by telephone if it is 
believed that such contact would further the examination of the present application. 

Please charge any shortages or credit any overages to Deposit Account No. 50-1302. 
Respectfully submitted, 

HICKMAN PALERMO TRUONG & BECKER LLP 

/DanielDLedesma#57 181/ 

Daniel D. Ledesma 
Reg. No. 57,181 

Date: December 13, 2007 

2055 Gateway Place, Suite 550 
San Jose, CA 95110 
Telephone: (408)414-1229 
Facsimile: (408) 414-1076 
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